Apple had to go through a tremendous amount of engineering effort, custom hardware development, and testing to get FaceID to work reliably. This sounds like a software-based system that uses a user’s camera. I’m also not exactly certain what these steps mean without making a lot of assumptions.

The user takes a photo of themselves

Okay? MS had developed an age estimator a decade or so ago. They put up a guess-my-age website that you could upload photographs to. It was relatively accurate (at least in my testing)in that it scored consistently and was usually within a few years of the right answer. I’m sure they’re better now.

The system then checks if there's a live human face in the frame

So it’s looking at a live video? What’s the picture for, then? Does it confirm the picture is the same person as in the video, in which case why would someone have to upload a picture?

The image is then uploaded to Yoti's backend server for estimation

Again, fine. Privacy concerns aside, that’s what we’d expect.

But out of gaming devices, how many have a video camera? Obviously phones and tablets do, as do most laptops, but neither my switch nor my steam deck have one, nor does my recently retired gaming pc. Am I su even if I’m playing on another device? Am I going to have to periodically re-authenticate?

I’m not even talking about spoofing here, which given the ubiquity of filters for phone cameras would be trivial.

This strikes me as someone’s project that was sold to management as a good idea and which now needs to find an application.

I’m also going to make the very safe assumption that despite their claims, their real world performance across ethnicities is not going to match up with their confident statements in their application. That’s been a pretty constant issue with this sort of application. They make the same claim about police facial recognition databases despite being repeatedly proven wrong.

The proposal also said, "To the extent that there is any risk, it is easily outweighed by the benefits to consumers and businesses of using this [Facial Age Estimation] method."

I really, really want to know what the actual harm being prevented is supposed to be such that it outweighs any other concerns. I don’t mean that some ten year old might play Cyberpunk. I mean actual research showing a quantified harm associated with it, along with harm reduction realized by implementing a parental-permission based age verification system.